Get the Splunk indexer name output.

[sanju005ind]

I am using the following query to get the output of all my forwardars/hosts

|metadata type=hosts | eval age = now() - lastTime | search age < 604800 | tags host | search tag::host=FINANCE| fields + host, firstTime, lastTime,totalCount, tag::host| convert ctime(firstTime) | convert ctime(lastTime) | sort - host | rename host as Host,firstTime as "First Reported",lastTime as "Last Reported",totalCount as "Total Events", tag::host as Tags

I would also like another field called splunk_server.However when I use splunk_server as a field I am not getting any output.

[gkanapathy · Accepted solution]

The metadata command as far as I know has no options to separate results by splunk_server (unlike, e.g., the eventcount command or search commands). There is probably no efficient way to get the information you are asking for short of logging onto each server separately and examining the metadata files in the index directory.

[Simeon]

Since that is a metadata search, I'm not sure the splunk_server field can be returned/used in that manner. Similarly, I'm not sure you can return the index field. You can definitely use those two fields as parameters to search on, but I don't think they will be returned in the results.

[sanju005ind]

I am doing a distributed search and get these metrics across multiple splunk servers

[Lowell]

Are you trying to do a distributed search and get these metrics across multiple splunk servers, or simply do something like | rename host as splunk_server?